Malicious Code Vulnerability in chai-as-validated Package
Summary
MAL-2025-192724: Malicious code in chai-as-validated (npm). Affects chai-as-validated versions 2.3.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The chai-as-validated package is an npm library that provides validation capabilities for Chai assertions. It allows developers to ensure that their test inputs meet specific criteria, enhancing the reliability of unit tests. However, this package has been identified to contain malicious code that could compromise the integrity of applications using it.
Vulnerability Detail
The vulnerability stems from malicious code embedded in version 2.3.2 of the chai-as-validated package. This code can potentially execute harmful operations within the user's environment, leading to data breaches or unauthorized access to sensitive information. The origin of this issue is linked to the package being compromised by malicious actors, which poses significant risks to developers and their applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall chai-as-validatedIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider removing the chai-as-validated package from your project until a secure version is released. You can do this by running 'npm uninstall chai-as-validated'. Alternatively, you may explore other validation libraries that do not have known vulnerabilities.
Conclusion
The chai-as-validated package has been compromised with malicious code, posing significant risks to applications that utilize it. It is essential for developers to update to a secure version or remove the package until a fix is available. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in your projects.
See every vulnerability recorded for chai-as-validated →
FAQ
The chai-as-validated package is used for validating inputs in Chai assertions, ensuring that test cases are robust and reliable.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your package-lock.json file.
If you cannot update the package right away, consider removing it from your project or using an alternative validation library until a secure version is available.
More information can be found in the vulnerability report on the Open Source Vulnerability database or by visiting the GitHub repository of the affected package.
The vulnerability was discovered by ReversingLabs, a security research firm specializing in identifying malicious code in software packages.
